fix: resolve multiple bugs found during comprehensive code review

[SimplicityGuy]

Summary

Comprehensive bug fixes, dependency modernization, security improvements, logging improvements, and documentation updates.

Dependency Replacement

• Replaced abandoned rq with yq — rq (last release 2019) replaced with actively maintained yq (mikefarah/yq) from Alpine repos. Removes entire Dockerfile builder stage, eliminates glibc-on-musl arm64/arm issue, removes gcompat and upx dependencies. Closes security: rq binary downloaded without checksum verification #17.

Logging Improvements

• Cron job output now visible in docker logs — Replaced broken 2>&1 | cat with /proc/1/fd/1 redirect (BusyBox crond swallows pipe output)
• Timestamped job execution — Start/end messages include ISO timestamps
• Formatted startup table — Container startup shows a clean table of scheduled jobs with schedule, name, and onstart status

Code Fixes (entrypoint.sh)

• Shared-settings merge order inverted — $shared was overriding per-job values instead of acting as defaults
• Broken shebang in generated scripts — echo "#\!/usr/bin/env bash" wrote a literal backslash
• parse_schedule failure silently produced broken crontab entries — @every now properly rejected (related: security: cron schedule strings are written to crontab without format validation #18)
• Missing null command guard in make_image_cmd
• Empty crontab crash — Container aborted if all jobs were invalid
• Unquoted container name in docker args — Mapping config keys with spaces produced broken --name args
• Missing closing quote in schedule-missing error message
• Temp file cleanup — Added trap for mktemp cleanup on error
• Dead code removal — Removed unused skip_next variable

Infrastructure Improvements

• update-project.yml now uses update-project.sh — Eliminated duplicate update logic between CI workflow and local script
• Fixed update-project.sh Docker Hub API — Added &name=dind-alpine filter so dind-alpine tags are found within page limits
• Fixed update-project.yml/.sh for single-stage Dockerfile — Removed stale builder image references after rq removal
• Added owner field to cleanup-images workflow

Documentation Fixes

• Updated README badges (centered div, Build, License, pre-commit, Docker, Shell, Alpine, Claude Code)
• Fixed grammar errors throughout README
• Documented undocumented config fields: environment, expose, networks, ports, volumes
• Documented all supported schedule shortcuts (sorted most→least frequent)
• Replaced @every examples with valid cron syntax
• Fixed stale GitLab registry path → ghcr.io
• Fixed --it → -it in README
• Updated CLAUDE.md: single-stage build, yq references, all 4 platform architectures
• Updated Alpine references from 3.21 to 3.23 across all samples

Config Fixes

• Renamed "null" key to "logrotate" in mapping config samples
• Added depends_on to docker-compose.yml

Issues Addressed

• Closes security: rq binary downloaded without checksum verification #17 (rq binary without checksum — eliminated entirely by replacing rq with yq)
• Related to security: cron schedule strings are written to crontab without format validation #18 (schedule validation — @every now properly rejected)

Test plan

• Build Docker image locally and verify entrypoint generates correct crontab
• Verify generated job scripts have correct #!/usr/bin/env bash shebang
• Test with mapping config containing ~~shared-settings to confirm per-job overrides work
• Test with @every schedule to confirm it's properly skipped with error message
• Test with mapping config keys containing spaces to verify --name quoting
• Test with all-invalid config to verify container starts gracefully with empty crontab
• Test YAML config parsing with yq
• Test TOML config parsing with yq
• Verify docker logs shows timestamped job output and startup table
• Run docker-compose up and confirm crontab starts after myapp
• Verify multi-arch build works (yq native Alpine package)

🤖 Generated with Claude Code